A security-focused culture is critical – here are some keys to building one